The application risk profile should be updated when reviewing functional requirements. This will help to identify and assess the potential risks that may arise from the changes to the application, and to plan and implement appropriate risk responses. Updating the application risk profile at this stage will also help to ensure that the changes are aligned with the organization’s objectives, policies, and standards, and that they meet the stakeholders’ expectations and needs. Updating the application risk profile after user acceptance testing, upon release to production, or during backlog scheduling are not the best points to update the risk profile, as they may be too late or too early to capture the relevant risks and their impacts. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.1.1, page 511

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 655.